How to check if code is AI generated: giveaways, detectors and the git history

Three ways exist to check if code is AI generated: read it for giveaways, paste it into a detector, or read the repository’s git history. Only the history can name an author, and only if nobody turned its marks off. On AICD Bench, a 2026 benchmark, every purpose-built detector scored below a random guess on its robust machine-or-human task.

Three ways to check if code is AI generated, and what each can prove

AI-generated code can be checked by reading it, by running a detector, or by reading the git history. Reading looks for style differences that a 2026 measurement found to be small, a detector returns a probability its own maker hedges, and the history records an author, a committer and any co-author line, each of which can be changed.

Whether a running app was made in a builder is a separate question with separate evidence: the address it is served on, the sign-up email it sends, the requests it makes. Working out whether an app was vibe coded is done from the outside, without the code.

What the answer is worth depends on who is asking how to check if code was written by AI. A teacher grades a student, a reviewer judges one change, and an owner decides whether an app they paid for can carry customers. The three methods read different things:

How to tell if code is AI generated by reading it

Giveaway lists name five tells: generic comments, flawless syntax with flawed logic, no personal style, invented methods and thin error handling. A 2026 measurement of 12,749 commits found AI and matched human code structurally similar: of the five, comment volume found support, error handling found partial support, and the human files repeated themselves more.

The development company Diatom Enterprises published its answer to what AI-generated code looks like on 9 February 2026, as five headings. Its five headings make the case that a reader can know if code is AI generated from the text alone.

The data to set them against is a paper by researchers at Indiana University and Nanyang Technological University, “A Large-Scale Comprehensive Measurement of AI-Generated Code in Real-World Repositories”. Version 3 of the measurement of 12,749 commits, dated 1 July 2026, covers 19,816 AI-involved code files from those commits; 7,471 AI file snapshots among them were matched against 15,424 human-written files.

Is this code AI generated? The five giveaways against the data

For someone holding a single file and wondering whether this code was written by AI, the table sets each heading, in the list’s own words, against what version 3 of the paper reports.

The paper’s first insight says it plainly: “AI-generated code is structurally similar to human code.” Read the numbers as dated, though. Version 2, dated 3 April 2026, reported two of these findings the other way round: comment ratios nearly identical (18.01 against 17.96 percent) and slightly more CodeQL alerts in the AI code (12.81 against 11.58 per thousand lines).

Two of the five, invented methods and thin error handling, describe failures rather than style, so a reader rarely sees them in a file: they show when the app breaks, and fixing AI-generated code that breaks starts from that failure, not from the author. If the app someone built for you already takes payments or holds customer data, that is the point to stop guessing at authorship and start with a free audit, where we weigh up with you where the app’s risk sits. The Production Hardening Sprint that can follow covers 123 deliverables across 13 engineering areas.

AI code check tools: what each code detector claims, and what a benchmark found

AI code check tools sell a percentage: Pangram claims 96.2 percent accuracy on code over 40 lines, and MyDetector claims over 95 percent. On AICD Bench, a 2026 benchmark of 2 million examples in 9 programming languages, every purpose-built detector scored below a random guess on the robust machine-or-human task.

An AI-generated code detector is a different tool from a scanner: a scanner looks for known bug patterns, while a detector estimates whether a model wrote the code. What a code scan is, and what it finds, is a separate subject. AI code can be detected only as a probability: a detector’s score describes the snippet it was given and is never proof of who wrote it.

Claims read on each vendor’s own page on 21 October 2026; Span’s detector page did not load that day, so Span has no row. For an AI code detector free of charge, MyDetector’s page states a free edition with “essential features for individual developers”, and Pangram’s page carries a “Try It for Free” link. The quickest way to detect AI-generated code is to paste a snippet into one of these, and the score it returns describes that snippet. How well a tool can detect if code is written by AI in a repository it has never seen is a different measurement, and benchmarks exist to make it.

Is there a 100% accurate AI detector?

AI detectors are never 100 percent accurate, and their makers say so: MyDetector states that no detector can be 100 percent certain, GPTZero that none is 100 percent accurate, and Pangram that boilerplate code carries little signal. A detector score is a probability for one snippet, never proof of who wrote it.

MyDetector’s report includes “an AI generation probability score”, and neither its page nor Pangram’s says a score measures the share of a file’s lines a model wrote. AI code detectors are reliable enough to start a question, and Pangram’s own post describes that use: recruiters who “use detection tools to prompt interview questions”.

Why vendor accuracy and benchmark results disagree

A vendor’s figure describes the code that vendor measured; Pangram’s, for one, is stated for code over 40 lines long. A benchmark built to be hard measures code the detector has not seen, which is the position of anyone handed a stranger’s repository.

AICD Bench, from researchers at MBZUAI, TU Darmstadt and INSAIT, holds 2 million examples from 77 models in 11 families across 9 programming languages. On its robust binary task, where the test code shifts in language and domain away from the training data, the best purpose-built detector, the zero-shot method Fast-DetectGPT, reached a Macro-F1 of 44.99 against 45.73 for a random baseline. In a separate test on a 5 percent sample, two general language models, Gemini 2.5 Flash and Gemma 3 27B, both scored above that baseline, and Gemini prompted to reason step by step scored highest, at 62.31. Its authors conclude that current detectors “perform particularly poorly on hybrid and adversarial code”, with hybrid meaning human-written code that a model rewrote or completed. In our reading, that mixed kind is what most teams ship.

OpenAI’s own detector is the plainest case. Its AI classifier for text, announced on 31 January 2023, correctly identified 26 percent of AI-written text in OpenAI’s evaluation on a challenge set of English texts and wrongly labeled human-written text as AI-written 9 percent of the time, and the announcement said it was “unreliable on code”. A note at the top of the same page now says: “As of July 20, 2023, the AI classifier is no longer available due to its low rate of accuracy.” The lesson we take: when the company that trained the model withdraws its own detector for low accuracy, a percentage from someone else’s tool is a lead to follow up, never a finding to act on.

Check if a GitHub repo is AI generated: what the commit record shows

A GitHub repo’s commit record is the strongest evidence of AI authorship: git stores an author and a committer on every commit, and tools can add a Co-authored-by trailer. GitHub documents commits from Copilot’s cloud agent as authored by Copilot. Every field can be rewritten, and GitHub’s Copilot docs state no commit mark for accepted editor suggestions.

Git’s own book defines the author as “the person who originally wrote the work” and the committer as “the person who last applied the work”. Both names come from the GIT_AUTHOR_* and GIT_COMMITTER_* environment variables when they are set, and otherwise from the user.name and user.email settings, as git’s commit documentation lists them.

A trailer is a line at the end of a commit message. GitHub’s co-author format is one Co-authored-by: name <name@example.com> line for each co-author, after an empty line below the description. Claude Code adds a trailer such as Co-Authored-By to its commits by default.

GitHub’s page on Copilot agents goes furthest: the cloud agent’s commits “are authored by Copilot, with the human who started the task marked as the co-author”, they are signed so they appear as “Verified”, and each commit message links to the agent session logs. GitHub can detect AI authorship only in that sense, by showing the record its own tools wrote; a feature that detects AI-written code in other commits is not stated on that page.

One command, run from a copy of the repository, prints the whole record for the last 20 commits:

git log --format='%h %an <%ae> | committer %cn <%ce> | %s%n%(trailers:key=Co-authored-by)' -20

In git’s pretty-formats reference, %h is the short hash, %an and %ae the author’s name and email, %cn and %ce the committer’s, %s the subject line, and %(trailers:key=Co-authored-by) shows only the co-author lines, matched case-insensitively. The -20 limits the output to 20 commits; a larger number reads further back. Three things are worth a question to whoever delivered the code:

• an author email you do not recognize, such as an address that is not the developer you hired
• an author and a committer that differ on many commits, meaning one person applied work recorded under another name
• a tool’s name in the author field or in a Co-authored-by line

The commands and fields here come from git’s and GitHub’s documentation; we did not open a repository for this page.

What the commit record cannot tell you

Every field in the record is writable. --author overrides the commit author, and --reset-author declares that “the authorship of the resulting commit now belongs to the committer”. A tool’s trailer is a setting: Claude Code’s settings reference lists an attribution key that changes or hides it, replacing the deprecated includeCoAuthoredBy. Suggestions accepted in an editor land in a commit the developer makes, under the name in their own git settings, and no commit mark for them is stated in GitHub’s Copilot docs.

So the record is the best evidence an owner can get, and it is optional, removable and partial. A missing trailer is a reason to ask the developer, not proof of anything. The same history is also the way back to a version that worked, which is where undoing what the AI changed begins.

What to check instead of who typed the code

Authorship matters less than three things an owner can ask to see: tests that run, a deploy that checks a change before it ships, and written rules that future AI-assisted changes must follow. Each one is a file or a log, whoever typed the code.

We audited 21 third-party AI-built apps in June and July 2026, and at least 18 of them had no working test anywhere: 17 had none at all, and a retail point-of-sale app had a checkout “test suite” that never executed the actual checkout code. Those 21 apps were chosen, not drawn at random, so the count describes them and is not a rate for AI-built software in general.

Ask for the test run: the command, its output and the date it last passed, which sits with the other checks you can run without reading code. The deploy step that runs those tests before a change reaches users is the second thing to request, one part of what makes code production ready. Last, the written rules that AI tools working on the code must follow: the files behind guardrails for AI coding agents.

The fuller list of evidence for code you cannot read is how you verify AI generated code before production. The handover side, meaning accounts, keys and the repository in your name, belongs to owning an app someone else built, and the standards behind all three for a team that keeps using AI tools are the engineering standards for AI-assisted teams.

In the Production Hardening Sprint, the handover includes guidance and automated checks for future AI-assisted changes. Deliverable 10.8, AI repository guardrails, is verified by reviewing the guidance and demonstrating CI catching a representative forbidden regression. Deliverable 10.9 is a 20 to 30-minute recorded walkthrough of the repository, data model and key architectural decisions. The production readiness report (13.1) is verified by accounting for all 123 IDs, keeping failures visible until resolved and explaining genuine non-applicable items.

Common questions about AI code detection

Can ChatGPT detect AI?

Not as proof of who wrote the code. A chat model asked whether a snippet is AI generated gives a judgment with no record behind it. On AICD Bench, a 2026 code benchmark, the two general language models tested, Gemini 2.5 Flash and Gemma 3 27B, did better than the purpose-built detectors on a 5 percent sample of its machine-or-human task, and ChatGPT was not among them. The place that can name a tool is the commit record, when the tool wrote its name there.

Can teachers tell if code is AI generated?

Not with certainty from the code alone. MIT Sloan’s guidance on AI detectors says detection software “is far from foolproof” and “has high error rates and can lead instructors to falsely accuse students of misconduct”. In our reading, course staff do better with process evidence, such as version history and asking the student to explain the code.

Can you test if code is AI generated?

No. A test shows what code does, not who wrote it, and what the code does is the question an owner can act on: whether sign-in, payments and data handling behave as they should.

How do I prove I didn’t use AI?

For code, nothing proves a negative. In our view, the evidence that carries weight is a commit history of small, dated changes under your own name, and being able to walk someone through why each part is written the way it is.

When should I get help with code a contractor may have written with AI?

Get help when the app takes payments or holds customer data and nobody on your side can read the code, because who typed it tells you nothing about either. AxonBuild offers a free audit, a 30-minute video call with no code access needed, where we talk through the app with you and agree where to start.